WORKSPACE
Rules of Engagement
The lab is isolated, single-tenant, and offline. These rules exist so the operator can act aggressively inside the sandbox without ever risking anything outside it.
Why Egress Is Blocked
Egress is any traffic leaving the lab network. The lab vSwitch has no uplink, so nothing in 10.10.10.0/24 can reach the internet, your home LAN, or the ARM host management interface.
That containment is what makes it safe to run real attack tooling, C2 beacons, and payloads: implants can never call home, credentials can never be exfiltrated, and a mistake stays inside the sandbox. Verify with Test-NetConnection 1.1.1.1 -Port 443 — it must fail.
Scope
Network
10.10.10.0/24 — isolated lab virtual network only
In scope
- +DC01.LAB (10.10.10.2)
- +FS01.LAB (10.10.10.3)
- +WIN01.LAB (10.10.10.105)
- +LINUX01 (10.10.10.50)
Out of scope
- −Any host outside 10.10.10.0/24.
- −The physical ARM host and its management interface.
- −The home LAN, ISP router, and every public IP.
- −Any real user, real credential, or real production system.
Safety Controls
- 01The lab vSwitch has no uplink. Verified with Test-NetConnection 1.1.1.1 -> fail.
- 02Snapshots taken before every phase, retained for 30 days.
- 03No real phishing. Payload delivery is done by dropping a file into a shared folder.
- 04No exfiltration outside the isolated segment. Artifacts stay on LINUX01.
- 05All actions journaled with timestamp, host, ATT&CK ID, and outcome.
Success Criteria
- ✦Every ATT&CK technique attempted is scored detected / partial / missed.
- ✦At least one remediation is verified by re-running the same technique.
- ✦The lab returns to the 'apprenticeship-final' snapshot cleanly.